import jwt from "jsonwebtoken";
import { env } from "../config/env";

export interface AccessPayload {
  sub: string; // user id (compte actif)
  username: string;
  role: string;
  imp?: string; // id du super_admin qui usurpe (impersonation), si applicable
}

export function signAccessToken(payload: AccessPayload): string {
  return jwt.sign(payload, env.jwt.accessSecret, {
    expiresIn: env.jwt.accessExpires as jwt.SignOptions["expiresIn"],
  });
}

export function signRefreshToken(sub: string, imp?: string): string {
  return jwt.sign({ sub, ...(imp ? { imp } : {}) }, env.jwt.refreshSecret, {
    expiresIn: env.jwt.refreshExpires as jwt.SignOptions["expiresIn"],
  });
}

export function verifyAccessToken(token: string): AccessPayload {
  return jwt.verify(token, env.jwt.accessSecret) as AccessPayload;
}

export function verifyRefreshToken(token: string): { sub: string; imp?: string } {
  return jwt.verify(token, env.jwt.refreshSecret) as { sub: string; imp?: string };
}